Katapult Alleged Data Exposure
The 2020 Katapult data breach occurred in September 2020 when customer user databases belonging to Katapult (katapult.com, formerly Cognical Inc.), a leading US public lease-to-own point-of-sale digital financing platform, were compromised and leaked online.
Exposed Data Types
4- Email addresses
- Usernames
- Names
- Passwords
About This Record
What information was compromised in the Katapult incident?
The leaked PostgreSQL Django user table (public.auth_user) encompasses 2,232,784 registered client profiles. Verified data classes include:
- Personal & Contact Identifiers: Customer first and last names along with primary registered email addresses.
- Security Credentials: Usernames and cryptographic password hashes secured using PBKDF2-SHA256 (12,000 iterations).
- System Flags & Account Timestamps: Account creation dates (date_joined), last login timestamps, and internal privilege flags.
How many accounts were affected?
Standardized RFC 5322 ASCII canonical verification confirmed 2,229,128 unique valid email addresses across 2,232,784 customer records.
Security advisory & personal identity protection
The exposure of customer names and emails from a consumer financing platform elevates the risk of targeted financial smishing, fake loan payment reminders, and credit-related social engineering. Affected consumers should:
- Maintain vigilance against unsolicited requests demanding lease payments or loan confirmations.
- Enable multi-factor authentication (MFA) across all banking and personal finance services.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
